Looking for Guidance on JSON Log Parser Creation

Hi @skadav ,

Can you share the smaple logs of what kind of Json logs you want to parse ?

You may find one of my Medium posts useful: https://medium.com/@cloudymike/parsing-netflow-data-in-google-secops-2f1b0f58ea49

I walk through building a parser, from scratch, for a JSON log (Netflow in this example).

-mike

@skadav SecOps just announced a public preview of auto-extraction for JSON logs. You may be able to utilize this feature for what you're trying to accomplish. Check out more details here:

https://cloud.google.com/chronicle/docs/event-processing/auto-extraction